Visa Payment Passkey: Pay Online Without a One-Time Code

Visa Payment Passkey is a way to approve an online card payment with your phone's own unlock (a fingerprint, a face scan, or your device PIN) instead of typing a one-time code sent by text or email. Visa describes it as "a biometric authentication method that replaces passwords and SMS one‑time codes," built on FIDO standards, per Visa. You set it up once for your card on your device, and after that, participating merchants can ask your device to confirm the purchase. Mastercard runs an equivalent service, the Mastercard payment passkey.

If you have started seeing a "create a passkey" prompt at checkout, this guide explains what it does, what it does not do, and what changes for prepaid and crypto cards.

A payment passkey is a passkey tied to a payment card rather than to a website login.

A passkey, in the FIDO Alliance's words, is a FIDO cryptographic credential "tied to a user's account on a website or application," per the FIDO Alliance. Instead of a secret you type, your device holds a cryptographic key and proves it has it when you unlock the device.

Visa applies that model to card payments:

• What it replaces. "Visa passkeys replace the need for passwords or one-time codes," per Visa's May 2024 announcement.
• What it is built on. Visa's developer documentation calls it "a FIDO-based authentication solution designed to enhance security and user experience for e-commerce payments," per Visa Developer.
• Where it applies. Visa says it "enables device-bound authentication across all Visa card-not-present (CNP) acceptance solutions," per Visa Developer. Card-not-present means online and in-app purchases, not tapping a card at a till.
• How you confirm. Your device's normal unlock: biometrics or "other device authentication method (e.g., PIN, pattern)," per Visa Developer.

Visa announced the service at its Payments Forum in May 2024 and said it was "integrating Visa Payment Passkey Service into Click to Pay," per Visa.

There are two moments: setting the passkey up, and using it.

Visa says the service "requires a one-time consumer set up to bind their device," per Visa. Mastercard's documentation gives the clearest picture of what that setup involves:

1. You are invited to create one. "The cardholder creates a Mastercard payment passkey during checkout on a merchant's site," per Mastercard Developers.
2. Your card issuer checks it is you. "The issuer confirms the cardholder's identity before linking a passkey to the card," per Mastercard Developers.
3. Your device creates the passkey. You confirm with your fingerprint, face or device PIN, and the passkey is now linked to that card on that device.

The Visa flow follows the same order. ID Tech's report on the Checkout.com and Adyen rollouts describes it as: once the cardholder's bank verifies their identity and the cardholder creates a passkey, the device unlock can authenticate future eligible transactions, per ID Tech.

At a participating merchant, the checkout asks your device to confirm the purchase and you unlock it. Mastercard puts it this way: "After setup, the cardholder approves payments at participating merchants with a fingerprint, face recognition, or other built-in device authentication," per Mastercard Developers.

No code is sent, so nothing has to arrive in your inbox or by text before the checkout times out.

Two numbers Visa publishes on its product page, both its own figures:

• "-50% fraud rates with biometric authentication vs. Short Message Service (SMS) one-time passcodes (OTP)," based on VisaNet data from July to December 2023, per Visa.
• "4B estimated consumer devices that support FIDO® authentication," per Visa, citing a FIDO Alliance submission.

The code-based check is still the default you will meet most often. For how it works, who decides when you get one, and why, see 3D Secure explained.

No. The fingerprint or face check happens on your phone or laptop.

The FIDO Alliance, which writes the standard Visa and Mastercard build on, says "Biometric information and processing continues to stay on the device and is never sent to any remote server," per the FIDO Alliance.

That also means the passkey is only as secure as your device lock. If someone else's face or fingerprint is enrolled on your phone, or your device PIN is easy to guess, they can approve what you can approve. Our crypto security basics for card users covers the habits that matter around this.

Visa's consumer page does not list countries; it says the passkey works "at participating merchants," per Visa. The rollouts with public dates are below.

The pattern: payment processors are switching it on for merchants, and card issuers are switching it on for cardholders. You only see the prompt when both sides support it.

A payment passkey needs two parties to opt in: the merchant's payment processor, and the issuer or program behind your card.

• The issuer side. Visa says issuers implement the passkey APIs "through Visa ID & Credential," per Visa Developer, and Mastercard has the issuer confirm your identity before linking a passkey. A prepaid or crypto card can only offer passkeys if its card program has done that work.
• The fallback. If a passkey can't be used, you are not locked out. Checkout.com says "If passkey authentication is unavailable, the transaction continues using existing verification methods," per Checkout.com. That can mean a 3D Secure code or link.
• It is not a way around a decline. A passkey confirms it is you. The purchase still goes through normal authorization, where the issuer checks the card and its balance. If a payment is refused after you confirm, the cause is elsewhere; why your crypto card is declined walks through the usual ones.

For a prepaid crypto card, the practical advice is simple: keep the address that receives your verification codes reachable, because that is the path your checkouts rely on unless your card program offers passkeys. If a passkey prompt does appear for your card, set it up only on a device you alone unlock.

These are easy to confuse because both use your face or fingerprint. A payment passkey confirms an online card payment at a merchant's checkout. Apple Pay and Google Pay are wallets that store a tokenized version of your card and can be used in shops and online. How a crypto card fits into Apple Wallet is covered in Apple Pay with a crypto card.

SolCard is a prepaid Visa / Mastercard card funded from a crypto wallet: you top up with USDT, USDC, SOL and other tokens on Solana, Ethereum, Base, Polygon and more, and spend it anywhere the card network is accepted. For how online checkout verification works on SolCard, see our 3D Secure guide.

The two tiers trade cost against access:

Top-up fees and FX spreads are on SolCard fees. Both tiers also charge $0.30 per transaction, per SolCard's help-centre fee breakdown, and a one-time card issuance fee applies.

Honest limitation: the Virtual card's 5% top-up fee adds up quickly, so it suits online subscriptions and shopping where you want a card without a bank account more than it suits high-volume spending. Platinum removes the top-up fee but requires identity verification and is not offered in the US. The virtual cards page lists what each card supports.

It is a FIDO-based passkey linked to your Visa card that lets you approve online payments with your device's fingerprint, face or PIN unlock instead of a one-time code. Visa describes it as "a biometric authentication method that replaces passwords and SMS one‑time codes," per Visa.

Visa reports "-50% fraud rates with biometric authentication vs." SMS one-time passcodes in its own July to December 2023 data, per Visa, and the FIDO Alliance says passkeys are "phishing-resistant." The weak point is your device lock: anyone who can unlock your phone can approve a payment with it.

No. It is optional, and where a passkey can't be used, Checkout.com says the transaction "continues using existing verification methods," per Checkout.com. You will see the usual code or link instead.

They are each network's version of the same idea. Both replace the code with your device unlock, both have your card issuer verify you before the passkey is used for payments, and both work at participating merchants, per Visa, ID Tech and Mastercard Developers. Which one you use depends on your card's network.

Visa announced the service in May 2024, but its product page names no countries and says only "participating merchants," per Visa. The rollouts we found are in India, the UK and Europe. Whether you get the prompt depends on your card issuer and the merchant's processor.

Only if the card program behind it has enabled passkeys with Visa or Mastercard. If it hasn't, online checkouts use the regular 3D Secure challenge, so keep the email or phone number that receives your codes reachable.

Visa Payment Passkey and its Mastercard counterpart replace the one-time code at online checkout with your device's own unlock. You set it up once per card and device, your issuer verifies you first, and your biometric data stays on the device. It only appears where both the merchant's processor and your card issuer support it, and processors like Adyen and Checkout.com started with the UK and Europe. Where it isn't available, checkouts fall back to existing verification methods, such as a 3D Secure code, so for a prepaid crypto card like SolCard, the useful step is keeping your verification inbox reachable.

• Visa -- Visa Payment Passkey
• Visa Developer -- Getting Started with Visa Payment Passkey
• Visa Developer -- Visa Payment Passkey for Merchants and PSPs
• Visa Developer -- Visa Payment Passkey for Issuers
• Visa -- Visa Reinvents the Card, Unveils New Products for Digital Age (May 15, 2024)
• Visa India -- Visa Launches Payment Passkey in India
• Mastercard Developers -- Payment Passkeys
• FIDO Alliance -- Passkeys
• Adyen -- Authenticate upgrade (September 22, 2026)
• Adyen -- Reduce Issuing authentication friction with passkeys
• Checkout.com -- Visa Payment Passkey for merchants (October 29, 2026)
• ID Tech -- Checkout.com and Adyen Begin Rolling Out Visa Payment Passkey